Zelena Laguna Hotel Listed by medusalocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations across hospitality and tourism by combining encryption with the threat of public data leaks. Listings on criminal leak sites have become a routine part of that landscape, often appearing before victims or investigators can fully confirm what happened.

On 15 November 2022, Zelena Laguna Hotel was named on the MedusaLocker ransomware leak site. The group claims to have stolen internal data in a ransomware attack. Public detail remains limited: the number of people affected is unknown, and the precise contents of the material have not been independently verified. For guests, staff and partners, the listing itself is reason enough to understand what is known and what practical steps follow.

Inside the incident

According to the available record, Zelena Laguna Hotel appeared on the MedusaLocker leak site on 15 November 2022. The group stated that it had exfiltrated internal files during a ransomware attack. No further technical particulars—such as the initial access method, the duration of unauthorised access, the volume of data taken, or any ransom demand—have been disclosed in the public summary.

The number of individuals potentially affected is recorded as unknown. There is no confirmed public statement from the hotel in the supplied facts that either accepts or disputes the listing. In short, the incident is documented principally through the threat actor’s claim that internal files were stolen and that the organisation had been added to its leak site.

Inside medusalocker

MedusaLocker is a ransomware operation that has been active for several years and is well documented in public threat reporting. Like many contemporary groups, it typically follows a double-extortion model: systems are encrypted to disrupt operations, while copies of data are removed and held as leverage. If payment is not made, the group threatens to publish or auction the material on a dedicated leak site.

MedusaLocker has historically targeted a range of sectors, including businesses that hold operational and customer records. Affiliates or operators often gain entry through common vectors such as exposed remote-access services, phishing, or unpatched vulnerabilities, though the precise route used against any single victim is frequently not made public. Once inside, the actors move laterally, stage data for exfiltration, and deploy the ransomware payload. The leak-site listing is itself a pressure tactic; it should be treated as a claim by the group rather than as independently confirmed fact unless corroborated.

In this case, the facts state only that Zelena Laguna Hotel was listed and that MedusaLocker claims to have stolen internal data. No additional statements attributed to the group about this specific victim are part of the record.

Who is Zelena Laguna Hotel?

Zelena Laguna Hotel operates in the hospitality sector. Hotels of this type typically manage guest reservations, payment details, identity documents presented at check-in, loyalty or contact information, staff records, and a range of internal operational files—contracts, correspondence, maintenance logs and financial documents.

A breach affecting such an organisation is consequential because hospitality businesses sit at the intersection of personal data, payment processing and day-to-day operations. Guests expect their stay-related information to remain confidential; staff and suppliers likewise entrust the business with personal and commercial details. Even when the exact scope of an incident is unclear, the mere possibility that internal files left the organisation raises legitimate questions for anyone who has interacted with the hotel.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No itemised list of data types—such as guest databases, payment card data, passport scans, employee records or specific document categories—has been disclosed. The number of people affected is unknown.

Organisations in the hotel sector commonly hold reservation systems, guest contact and identification data, billing information, employee personnel files and assorted business documents. It is reasonable to note that these categories often appear in hospitality incidents generally. However, it is not established that any particular category was present in the material MedusaLocker claims to have taken from Zelena Laguna Hotel. Exact contents remain unconfirmed.

The real-world impact

For individuals, the primary risks associated with internal hotel files are misuse of personal details, targeted phishing that references a real stay or booking, and, where payment or identity data are involved, potential fraud. Because the precise data set is undisclosed, these remain possibilities rather than proven outcomes. People who have stayed at, worked for or contracted with the hotel may wish to treat unsolicited messages that cite the property with extra caution.

For the organisation, a ransomware incident and a public leak-site listing can mean operational disruption, investigative and recovery costs, regulatory notification duties where personal data are involved, and reputational strain with guests and partners. The absence of confirmed figures on scale or data types does not remove those pressures; it simply leaves the full extent still to be clarified by the hotel or by independent reporting.

If your data was in this claimed breach

If you believe your information may have been among the internal files MedusaLocker claims to have taken, practical first steps are straightforward and do not require panic.

• Monitor bank and card statements for unfamiliar charges and contact your provider promptly if anything appears wrong.
• Treat emails, calls or messages that reference Zelena Laguna Hotel or a past booking with scepticism; verify through official channels before clicking links or supplying information.
• Change passwords for accounts that may have shared credentials or recovery details linked to hotel bookings, and enable multi-factor authentication where available.
• If you provided identity documents or sensitive personal data to the hotel, remain alert to signs of identity misuse and consider free credit or fraud alerts offered in your country.
• Keep records of any suspicious contact so you can report it to the hotel and, if needed, to local authorities.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That check does not confirm or deny involvement in this specific incident, but it can indicate whether your details appear elsewhere and help you prioritise further precautions. Public detail on this event remains limited; staying attentive to official updates from the hotel and to ordinary account hygiene is the most useful response available while the facts stay incomplete.

AICompiled with AI assistance from public sources and published under our editorial standards.